Re: Re: [KAPDA::#16] - SMF SQL Injection
- From: retrogod@xxxxxxxxxxxxx
- Date: 10 Dec 2005 20:46:01 -0000
I'm a developer from over at simplemachines and I do not see how this can pose an exploit? Let's examine the code piece by piece:
The code is entered at this point:
So, will be executed if $_REQUEST['start'] is a string. It's then used in the query. However, it's used in the query in this piece of code:
substr(strtolower($_REQUEST['start']), 0, 1)
So, the string is set to lower case, and then only the FIRST letter is used within the query. How can anyone exploit the database with a one character insertion? Of course this is within single quotes as well, so it cannot even be a command.
I simply cannot see how you could possibly exploit SQL from this?
the only problem I see is path disclosure, 'cause you can inject only a one char string:
SELECT COUNT(ID_MEMBER) FROM smf_members WHERE LOWER(SUBSTRING(realName, 1, 1)) < '\' AND is_activated = 1
and at screen, you have:
Errore di sintassi nella query SQL vicino a ''\'
AND is_activated = 1' linea 3
but I think you cannot inject commands...
- Prev by Date: Re: [Full-disclosure] [scip_Advisory] NetGear RP114 Flooding Denial ofService
- Next by Date: oracle not only offeder - researchers NOT responsible?
- Previous by thread: Re: [KAPDA::#16] - SMF SQL Injection
- Next by thread: Re: Re: [KAPDA::#16] - SMF SQL Injection